PDF malware analysis — malicious · 6fb6a97b1367d86a

MALICIOUS

PDF

46.3 KB Created: 2020-10-19 02:29:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-12-25

MD5: 31716302fe03550062d3c13e5218dfaf SHA-1: ad6a19a9e7cec985e048e841aa3b6099e377dae2 SHA-256: 6fb6a97b1367d86afdbb1f0f3f6f9e7d73bc711311c28074f99ec6600f468ad4

194 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 5

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/123?keyword=uts+course+handbook+2020 In PDF document text
- https://jobubati.weebly.com/uploads/1/3/1/4/131453688/2948428.pdfIn PDF document text
- https://dojudiwoju.weebly.com/uploads/1/3/1/4/131406456/wakim_kimef_gilozinanemi.pdfIn PDF document text
- https://dokakida.weebly.com/uploads/1/3/1/3/131380589/vadofotu.pdfIn PDF document text
- https://lodirunesu.weebly.com/uploads/1/3/0/8/130874391/rotolorozadinif.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369173/normal_5f87a23002c47.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369762/normal_5f898a50d3e5c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379616/normal_5f8c388c5ecdd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4378845/normal_5f8c8141d8069.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4382772/normal_5f8c134827281.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367912/normal_5f8a82786fa9d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4378618/normal_5f8bb46c4f440.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366952/normal_5f8c9aafbeadc.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366654/normal_5f8953acea63e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4376374/normal_5f8a30ce9796f.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/57f4cadc-3eab-4068-9429-175c264e4d31/57231297789.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c2a85767-7be1-4706-abb7-32f1323c6b22/bemege.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f8d2b0e6-aed2-48bc-85b1-1e6c4e841a6c/81807827144.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8b517bb8-1a11-4a32-a088-e988272cbe6c/sri_narasimha_kavacham_telugu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f3e6e401-f09b-4f6e-9bff-a694bebb3667/48363818368.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/289c9157-2498-43d2-a355-1d5e1b233efa/51118898212.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9f7d5131-2402-44f4-8a7a-d358fa02a5bc/14372348661.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b686f10b-eac0-4131-9dda-41c042351f70/40117468267.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/af675e1e-db7f-41f2-ab6d-659e849911ec/gidikaxamawixafoxunarikis.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dc5f3d42-66de-4a99-a19b-12fadc5e0c21/fakobemuluzodapen.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007604.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7604	5464 bytes
SHA-256: `a72099bbb7596e75f09d4ebaf942bb9c6fe54e3f11508bd2957c4ec0b7312405`
`font_01_sfnt_off00008887.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8887	10420 bytes
SHA-256: `ddc409995a928cd36000b8e5ae8760acfe684dda8198d379cccd70e3676ae642`

Open this report in the interactive analyzer, or submit your own file for analysis.